1/* 2 * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the Apache License 2.0 (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10/* 11 * DES low level APIs are deprecated for public use, but still ok for internal 12 * use. 13 */ 14#include "internal/deprecated.h" 15 16#include <stdio.h> 17#include "internal/cryptlib.h" 18#ifndef OPENSSL_NO_DES 19# include <openssl/objects.h> 20# include "crypto/evp.h" 21# include "crypto/sha.h" 22# include <openssl/des.h> 23# include <openssl/rand.h> 24# include "evp_local.h" 25 26typedef struct { 27 union { 28 OSSL_UNION_ALIGN; 29 DES_key_schedule ks[3]; 30 } ks; 31 union { 32 void (*cbc) (const void *, void *, size_t, 33 const DES_key_schedule *, unsigned char *); 34 } stream; 35} DES_EDE_KEY; 36# define ks1 ks.ks[0] 37# define ks2 ks.ks[1] 38# define ks3 ks.ks[2] 39 40# if defined(AES_ASM) && (defined(__sparc) || defined(__sparc__)) 41/* ---------^^^ this is not a typo, just a way to detect that 42 * assembler support was in general requested... */ 43# include "crypto/sparc_arch.h" 44 45# define SPARC_DES_CAPABLE (OPENSSL_sparcv9cap_P[1] & CFR_DES) 46 47void des_t4_key_expand(const void *key, DES_key_schedule *ks); 48void des_t4_ede3_cbc_encrypt(const void *inp, void *out, size_t len, 49 const DES_key_schedule ks[3], unsigned char iv[8]); 50void des_t4_ede3_cbc_decrypt(const void *inp, void *out, size_t len, 51 const DES_key_schedule ks[3], unsigned char iv[8]); 52# endif 53 54static int des_ede_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, 55 const unsigned char *iv, int enc); 56 57static int des_ede3_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, 58 const unsigned char *iv, int enc); 59 60static int des3_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr); 61 62# define data(ctx) EVP_C_DATA(DES_EDE_KEY,ctx) 63 64/* 65 * Because of various casts and different args can't use 66 * IMPLEMENT_BLOCK_CIPHER 67 */ 68 69static int des_ede_ecb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, 70 const unsigned char *in, size_t inl) 71{ 72 BLOCK_CIPHER_ecb_loop() 73 DES_ecb3_encrypt((const_DES_cblock *)(in + i), 74 (DES_cblock *)(out + i), 75 &data(ctx)->ks1, &data(ctx)->ks2, 76 &data(ctx)->ks3, EVP_CIPHER_CTX_is_encrypting(ctx)); 77 return 1; 78} 79 80static int des_ede_ofb_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, 81 const unsigned char *in, size_t inl) 82{ 83 while (inl >= EVP_MAXCHUNK) { 84 int num = EVP_CIPHER_CTX_get_num(ctx); 85 DES_ede3_ofb64_encrypt(in, out, (long)EVP_MAXCHUNK, 86 &data(ctx)->ks1, &data(ctx)->ks2, 87 &data(ctx)->ks3, 88 (DES_cblock *)ctx->iv, 89 &num); 90 EVP_CIPHER_CTX_set_num(ctx, num); 91 inl -= EVP_MAXCHUNK; 92 in += EVP_MAXCHUNK; 93 out += EVP_MAXCHUNK; 94 } 95 if (inl) { 96 int num = EVP_CIPHER_CTX_get_num(ctx); 97 DES_ede3_ofb64_encrypt(in, out, (long)inl, 98 &data(ctx)->ks1, &data(ctx)->ks2, 99 &data(ctx)->ks3, 100 (DES_cblock *)ctx->iv, 101 &num); 102 EVP_CIPHER_CTX_set_num(ctx, num); 103 } 104 return 1; 105} 106 107static int des_ede_cbc_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, 108 const unsigned char *in, size_t inl) 109{ 110 DES_EDE_KEY *dat = data(ctx); 111 112 if (dat->stream.cbc != NULL) { 113 (*dat->stream.cbc) (in, out, inl, dat->ks.ks, 114 ctx->iv); 115 return 1; 116 } 117 118 while (inl >= EVP_MAXCHUNK) { 119 DES_ede3_cbc_encrypt(in, out, (long)EVP_MAXCHUNK, 120 &dat->ks1, &dat->ks2, &dat->ks3, 121 (DES_cblock *)ctx->iv, 122 EVP_CIPHER_CTX_is_encrypting(ctx)); 123 inl -= EVP_MAXCHUNK; 124 in += EVP_MAXCHUNK; 125 out += EVP_MAXCHUNK; 126 } 127 if (inl) 128 DES_ede3_cbc_encrypt(in, out, (long)inl, 129 &dat->ks1, &dat->ks2, &dat->ks3, 130 (DES_cblock *)ctx->iv, 131 EVP_CIPHER_CTX_is_encrypting(ctx)); 132 return 1; 133} 134 135static int des_ede_cfb64_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, 136 const unsigned char *in, size_t inl) 137{ 138 while (inl >= EVP_MAXCHUNK) { 139 int num = EVP_CIPHER_CTX_get_num(ctx); 140 DES_ede3_cfb64_encrypt(in, out, (long)EVP_MAXCHUNK, 141 &data(ctx)->ks1, &data(ctx)->ks2, 142 &data(ctx)->ks3, (DES_cblock *)ctx->iv, 143 &num, EVP_CIPHER_CTX_is_encrypting(ctx)); 144 EVP_CIPHER_CTX_set_num(ctx, num); 145 inl -= EVP_MAXCHUNK; 146 in += EVP_MAXCHUNK; 147 out += EVP_MAXCHUNK; 148 } 149 if (inl) { 150 int num = EVP_CIPHER_CTX_get_num(ctx); 151 DES_ede3_cfb64_encrypt(in, out, (long)inl, 152 &data(ctx)->ks1, &data(ctx)->ks2, 153 &data(ctx)->ks3, (DES_cblock *)ctx->iv, 154 &num, EVP_CIPHER_CTX_is_encrypting(ctx)); 155 EVP_CIPHER_CTX_set_num(ctx, num); 156 } 157 return 1; 158} 159 160/* 161 * Although we have a CFB-r implementation for 3-DES, it doesn't pack the 162 * right way, so wrap it here 163 */ 164static int des_ede3_cfb1_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, 165 const unsigned char *in, size_t inl) 166{ 167 size_t n; 168 unsigned char c[1], d[1]; 169 170 if (!EVP_CIPHER_CTX_test_flags(ctx, EVP_CIPH_FLAG_LENGTH_BITS)) 171 inl *= 8; 172 for (n = 0; n < inl; ++n) { 173 c[0] = (in[n / 8] & (1 << (7 - n % 8))) ? 0x80 : 0; 174 DES_ede3_cfb_encrypt(c, d, 1, 1, 175 &data(ctx)->ks1, &data(ctx)->ks2, 176 &data(ctx)->ks3, (DES_cblock *)ctx->iv, 177 EVP_CIPHER_CTX_is_encrypting(ctx)); 178 out[n / 8] = (out[n / 8] & ~(0x80 >> (unsigned int)(n % 8))) 179 | ((d[0] & 0x80) >> (unsigned int)(n % 8)); 180 } 181 182 return 1; 183} 184 185static int des_ede3_cfb8_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, 186 const unsigned char *in, size_t inl) 187{ 188 while (inl >= EVP_MAXCHUNK) { 189 DES_ede3_cfb_encrypt(in, out, 8, (long)EVP_MAXCHUNK, 190 &data(ctx)->ks1, &data(ctx)->ks2, 191 &data(ctx)->ks3, (DES_cblock *)ctx->iv, 192 EVP_CIPHER_CTX_is_encrypting(ctx)); 193 inl -= EVP_MAXCHUNK; 194 in += EVP_MAXCHUNK; 195 out += EVP_MAXCHUNK; 196 } 197 if (inl) 198 DES_ede3_cfb_encrypt(in, out, 8, (long)inl, 199 &data(ctx)->ks1, &data(ctx)->ks2, 200 &data(ctx)->ks3, (DES_cblock *)ctx->iv, 201 EVP_CIPHER_CTX_is_encrypting(ctx)); 202 return 1; 203} 204 205BLOCK_CIPHER_defs(des_ede, DES_EDE_KEY, NID_des_ede, 8, 16, 8, 64, 206 EVP_CIPH_RAND_KEY | EVP_CIPH_FLAG_DEFAULT_ASN1, 207 des_ede_init_key, NULL, NULL, NULL, des3_ctrl) 208# define des_ede3_cfb64_cipher des_ede_cfb64_cipher 209# define des_ede3_ofb_cipher des_ede_ofb_cipher 210# define des_ede3_cbc_cipher des_ede_cbc_cipher 211# define des_ede3_ecb_cipher des_ede_ecb_cipher 212 BLOCK_CIPHER_defs(des_ede3, DES_EDE_KEY, NID_des_ede3, 8, 24, 8, 64, 213 EVP_CIPH_RAND_KEY | EVP_CIPH_FLAG_DEFAULT_ASN1, 214 des_ede3_init_key, NULL, NULL, NULL, des3_ctrl) 215 216 BLOCK_CIPHER_def_cfb(des_ede3, DES_EDE_KEY, NID_des_ede3, 24, 8, 1, 217 EVP_CIPH_RAND_KEY | EVP_CIPH_FLAG_DEFAULT_ASN1, 218 des_ede3_init_key, NULL, NULL, NULL, des3_ctrl) 219 220 BLOCK_CIPHER_def_cfb(des_ede3, DES_EDE_KEY, NID_des_ede3, 24, 8, 8, 221 EVP_CIPH_RAND_KEY | EVP_CIPH_FLAG_DEFAULT_ASN1, 222 des_ede3_init_key, NULL, NULL, NULL, des3_ctrl) 223 224static int des_ede_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, 225 const unsigned char *iv, int enc) 226{ 227 DES_cblock *deskey = (DES_cblock *)key; 228 DES_EDE_KEY *dat = data(ctx); 229 230 dat->stream.cbc = NULL; 231# if defined(SPARC_DES_CAPABLE) 232 if (SPARC_DES_CAPABLE) { 233 int mode = EVP_CIPHER_CTX_get_mode(ctx); 234 235 if (mode == EVP_CIPH_CBC_MODE) { 236 des_t4_key_expand(&deskey[0], &dat->ks1); 237 des_t4_key_expand(&deskey[1], &dat->ks2); 238 memcpy(&dat->ks3, &dat->ks1, sizeof(dat->ks1)); 239 dat->stream.cbc = enc ? des_t4_ede3_cbc_encrypt : 240 des_t4_ede3_cbc_decrypt; 241 return 1; 242 } 243 } 244# endif 245 DES_set_key_unchecked(&deskey[0], &dat->ks1); 246 DES_set_key_unchecked(&deskey[1], &dat->ks2); 247 memcpy(&dat->ks3, &dat->ks1, sizeof(dat->ks1)); 248 return 1; 249} 250 251static int des_ede3_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key, 252 const unsigned char *iv, int enc) 253{ 254 DES_cblock *deskey = (DES_cblock *)key; 255 DES_EDE_KEY *dat = data(ctx); 256 257 dat->stream.cbc = NULL; 258# if defined(SPARC_DES_CAPABLE) 259 if (SPARC_DES_CAPABLE) { 260 int mode = EVP_CIPHER_CTX_get_mode(ctx); 261 262 if (mode == EVP_CIPH_CBC_MODE) { 263 des_t4_key_expand(&deskey[0], &dat->ks1); 264 des_t4_key_expand(&deskey[1], &dat->ks2); 265 des_t4_key_expand(&deskey[2], &dat->ks3); 266 dat->stream.cbc = enc ? des_t4_ede3_cbc_encrypt : 267 des_t4_ede3_cbc_decrypt; 268 return 1; 269 } 270 } 271# endif 272 DES_set_key_unchecked(&deskey[0], &dat->ks1); 273 DES_set_key_unchecked(&deskey[1], &dat->ks2); 274 DES_set_key_unchecked(&deskey[2], &dat->ks3); 275 return 1; 276} 277 278static int des3_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, void *ptr) 279{ 280 281 DES_cblock *deskey = ptr; 282 int kl; 283 284 switch (type) { 285 case EVP_CTRL_RAND_KEY: 286 kl = EVP_CIPHER_CTX_get_key_length(ctx); 287 if (kl < 0 || RAND_priv_bytes(ptr, kl) <= 0) 288 return 0; 289 DES_set_odd_parity(deskey); 290 if (kl >= 16) 291 DES_set_odd_parity(deskey + 1); 292 if (kl >= 24) 293 DES_set_odd_parity(deskey + 2); 294 return 1; 295 296 default: 297 return -1; 298 } 299} 300 301const EVP_CIPHER *EVP_des_ede(void) 302{ 303 return &des_ede_ecb; 304} 305 306const EVP_CIPHER *EVP_des_ede3(void) 307{ 308 return &des_ede3_ecb; 309} 310 311 312# include <openssl/sha.h> 313 314static const unsigned char wrap_iv[8] = 315 { 0x4a, 0xdd, 0xa2, 0x2c, 0x79, 0xe8, 0x21, 0x05 }; 316 317static int des_ede3_unwrap(EVP_CIPHER_CTX *ctx, unsigned char *out, 318 const unsigned char *in, size_t inl) 319{ 320 unsigned char icv[8], iv[8], sha1tmp[SHA_DIGEST_LENGTH]; 321 int rv = -1; 322 if (inl < 24) 323 return -1; 324 if (out == NULL) 325 return inl - 16; 326 memcpy(ctx->iv, wrap_iv, 8); 327 /* Decrypt first block which will end up as icv */ 328 des_ede_cbc_cipher(ctx, icv, in, 8); 329 /* Decrypt central blocks */ 330 /* 331 * If decrypting in place move whole output along a block so the next 332 * des_ede_cbc_cipher is in place. 333 */ 334 if (out == in) { 335 memmove(out, out + 8, inl - 8); 336 in -= 8; 337 } 338 des_ede_cbc_cipher(ctx, out, in + 8, inl - 16); 339 /* Decrypt final block which will be IV */ 340 des_ede_cbc_cipher(ctx, iv, in + inl - 8, 8); 341 /* Reverse order of everything */ 342 BUF_reverse(icv, NULL, 8); 343 BUF_reverse(out, NULL, inl - 16); 344 BUF_reverse(ctx->iv, iv, 8); 345 /* Decrypt again using new IV */ 346 des_ede_cbc_cipher(ctx, out, out, inl - 16); 347 des_ede_cbc_cipher(ctx, icv, icv, 8); 348 if (ossl_sha1(out, inl - 16, sha1tmp) /* Work out hash of first portion */ 349 && CRYPTO_memcmp(sha1tmp, icv, 8) == 0) 350 rv = inl - 16; 351 OPENSSL_cleanse(icv, 8); 352 OPENSSL_cleanse(sha1tmp, SHA_DIGEST_LENGTH); 353 OPENSSL_cleanse(iv, 8); 354 OPENSSL_cleanse(ctx->iv, 8); 355 if (rv == -1) 356 OPENSSL_cleanse(out, inl - 16); 357 358 return rv; 359} 360 361static int des_ede3_wrap(EVP_CIPHER_CTX *ctx, unsigned char *out, 362 const unsigned char *in, size_t inl) 363{ 364 unsigned char sha1tmp[SHA_DIGEST_LENGTH]; 365 if (out == NULL) 366 return inl + 16; 367 /* Copy input to output buffer + 8 so we have space for IV */ 368 memmove(out + 8, in, inl); 369 /* Work out ICV */ 370 if (!ossl_sha1(in, inl, sha1tmp)) 371 return -1; 372 memcpy(out + inl + 8, sha1tmp, 8); 373 OPENSSL_cleanse(sha1tmp, SHA_DIGEST_LENGTH); 374 /* Generate random IV */ 375 if (RAND_bytes(ctx->iv, 8) <= 0) 376 return -1; 377 memcpy(out, ctx->iv, 8); 378 /* Encrypt everything after IV in place */ 379 des_ede_cbc_cipher(ctx, out + 8, out + 8, inl + 8); 380 BUF_reverse(out, NULL, inl + 16); 381 memcpy(ctx->iv, wrap_iv, 8); 382 des_ede_cbc_cipher(ctx, out, out, inl + 16); 383 return inl + 16; 384} 385 386static int des_ede3_wrap_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, 387 const unsigned char *in, size_t inl) 388{ 389 /* 390 * Sanity check input length: we typically only wrap keys so EVP_MAXCHUNK 391 * is more than will ever be needed. Also input length must be a multiple 392 * of 8 bits. 393 */ 394 if (inl >= EVP_MAXCHUNK || inl % 8) 395 return -1; 396 397 if (ossl_is_partially_overlapping(out, in, inl)) { 398 ERR_raise(ERR_LIB_EVP, EVP_R_PARTIALLY_OVERLAPPING); 399 return 0; 400 } 401 402 if (EVP_CIPHER_CTX_is_encrypting(ctx)) 403 return des_ede3_wrap(ctx, out, in, inl); 404 else 405 return des_ede3_unwrap(ctx, out, in, inl); 406} 407 408static const EVP_CIPHER des3_wrap = { 409 NID_id_smime_alg_CMS3DESwrap, 410 8, 24, 0, 411 EVP_CIPH_WRAP_MODE | EVP_CIPH_CUSTOM_IV | EVP_CIPH_FLAG_CUSTOM_CIPHER 412 | EVP_CIPH_FLAG_DEFAULT_ASN1, 413 EVP_ORIG_GLOBAL, 414 des_ede3_init_key, des_ede3_wrap_cipher, 415 NULL, 416 sizeof(DES_EDE_KEY), 417 NULL, NULL, NULL, NULL 418}; 419 420const EVP_CIPHER *EVP_des_ede3_wrap(void) 421{ 422 return &des3_wrap; 423} 424 425#endif 426